A practical baseline for Linux servers. Adapt to your distribution, workload, and security policy.
|
Create named administrator accounts; avoid routine direct root login. Use sudo with least privilege. Use SSH keys where practical. Disable password authentication only after confirming key-based access works.
|
Set PermitRootLogin to prohibit-password or no. Review authorized_keys, sudoers entries, inactive accounts, and privileged groups regularly. Use MFA or an access gateway for administrative access where available.
|
|
Ensure time synchronization is working and logs are retained centrally where possible. Configure backups for required data and system configuration. Periodically test restoration. Protect secrets and private keys with restrictive permissions. Never commit credentials to repositories.
|
Record baseline configuration. Periodically review authentication logs, updates, firewall rules, and exposed services. ss -tulpn Review listening sockets. systemctl --failed Identify failed systemd units. journalctl -p warning..alert -b Review current-boot warnings and higher-severity messages.
|
|
Default-deny inbound traffic where feasible. Allow only required ports from appropriate source ranges. Restrict SSH exposure with firewall rules, VPN, or an access gateway when possible.
|
Use SELinux or AppArmor in enforcing mode where supported. Investigate security-control denials rather than disabling controls by default. Protect cloud metadata services and management interfaces according to the platform's guidance.
|
|
Apply security updates through your normal change process. Confirm reboot requirements for kernel and core-library updates. Remove or disable packages, daemons, and listening services that are not required.
|
Check enabled services with: systemctl --type=service --state=running Check listening sockets with: ss -tulpn Keep a supported OS release and a documented rollback/recovery plan.
|
No comments yet.
Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.
